Skip to main content
All API requests require authentication via Bearer token.

API Key Format

  • uc_live_ prefix for production
  • uc_test_ prefix for development/testing

Using with SDK

Using with REST

Include the API key in the Authorization header:

Security Best Practices

Use environment variables

Never hardcode API keys. Use .env files or secret managers.

Don't commit keys

Add .env to .gitignore. Use .env.example for templates.

Rotate if exposed

If a key is compromised, regenerate it immediately in the dashboard.

Use test keys for dev

Use uc_test_ keys during development to avoid polluting production data.

Environment Setup

Server-Side Only

API keys should only be used server-side. Never expose them in client-side code or browser JavaScript.
For client-side applications, create a backend API route that proxies requests to UltraContext.